As of mid-2026 there is no federal OSHA standard devoted specifically to workplace violence covering employers generally. The duty is real anyway, and it comes from three directions at once: the General Duty Clause of the Occupational Safety and Health Act, a small but growing number of state statutes that impose concrete planning and training requirements, and ordinary negligence exposure under state tort law for hiring, supervision, and premises safety.

The result is an uneven picture. An employer in one state may face a detailed written-plan mandate with logs and training records; an employer in another may face only the general duty and the practical consequences of ignoring a known threat. Both need a process; only one has a statute telling it what the process must include.

Where the duty comes from

The General Duty Clause requires employers to furnish a place of employment free from recognized hazards likely to cause death or serious physical harm. OSHA has used it to cite employers for workplace violence exposure, most often in settings where the hazard is well documented in the industry — health care and social service work in particular, where the agency has published prevention guidance for years. The elements an agency looks for are recognizability of the hazard, likelihood of serious harm, and the availability of feasible measures that would materially reduce it. That last element is why prevention documentation matters so much: it establishes what the employer knew and what it did.

State law is the second source, and it varies. California's SB 553, effective in 2024, is the most cited example: it requires most California employers to establish, implement, and maintain a written workplace violence prevention plan, provide training, and maintain a violent incident log, among other obligations. Several states have separate requirements aimed at hospitals and health care facilities. These are state rules with state-specific scope — they are useful as a template for what regulators consider adequate, but an employer outside those states is not automatically subject to them, and an employer inside them must follow the actual statutory text rather than a summary.

The third source is tort law. Claims for negligent hiring, negligent retention, negligent supervision, and inadequate premises security are creatures of state common law, and they turn heavily on foreseeability — what the employer knew or should have known before the incident.

Watch out: the most damaging fact in a post-incident investigation is usually a complaint that went nowhere. Reports of threats, stalking, escalating conflict, or a weapon on site should have a defined route and a documented outcome. An unanswered report converts a general hazard into a recognized one and supplies the foreseeability element in a negligence claim.

What a written prevention plan contains

Even where no statute requires one, the components that regulators and plaintiffs' counsel look for are consistent.

  • A hazard assessment specific to each site, shift, and job — including cash handling, late hours, lone work, home visits, and public contact
  • Named responsibility: who owns the plan, who receives reports, and who is authorized to act
  • Reporting procedures with more than one channel, and an explicit no-retaliation commitment
  • Response procedures for an active threat, including evacuation, shelter, and emergency contact protocols
  • Engineering and administrative controls: access control, lighting, alarm or duress devices, visitor management, staffing levels
  • Training at hire and periodically, with content, dates, and attendance recorded
  • An incident log recording what happened, where, who was involved by role, and what corrective action followed
  • A scheduled review after any incident and at least annually, with changes documented

Records deserve attention on their own. Certain work-related injuries from violent incidents may be recordable under OSHA's injury and illness recordkeeping rules, and employees generally have rights to information about workplace hazards. Where a state statute requires a violent incident log, that log is a separate obligation from OSHA recordkeeping, with its own contents and retention period.

Running a threat assessment

The hardest cases involve a specific person rather than a general condition. A structured process beats improvisation, and it keeps individual managers from making decisions that create discrimination exposure.

  1. Receive and stabilize. Take the report, address immediate safety, and avoid promising confidentiality you cannot deliver — say instead that information will be shared only with those who need it.
  2. Convene a small, defined team. HR, security, a senior operations leader, and counsel. A standing team with a written charter responds faster and more consistently than an ad hoc group.
  3. Gather facts, not impressions. What was said or done, when, in front of whom, and what the reporting person observed directly. Separate behaviour from speculation about mental state.
  4. Assess behaviourally. The focus is on conduct that signals escalation — direct or veiled threats, weapons references, fixation, boundary violations, stalking — not on diagnosis, personality, or category membership.
  5. Choose interim measures. Separation of parties, schedule or location changes, suspension pending investigation, access restrictions, security presence, or law enforcement involvement where warranted.
  6. Decide, act, and document. Record the facts, the reasoning, the measures taken, and the review date. Close the loop with the person who reported, to the extent you can.

Practical step: decide in advance how the company handles an employee's disclosure that they are experiencing domestic violence, and put the answer in a policy. Several states provide leave, schedule change, or accommodation rights for victims of domestic violence, sexual assault, or stalking, and some address workplace protective orders. Employers can often add practical measures — parking changes, reception alerts, phone routing — that cost little and matter enormously.

Three constraints trip employers up. First, disability law. An employer may hold employees to a legitimate direct-threat and conduct standard, but assumptions about dangerousness based on a perceived mental health condition rather than actual behaviour are precisely what the ADA prohibits — and the statute's definitional provisions at 42 U.S.C. § 12111 frame the qualification and direct-threat analysis. Base decisions on conduct, apply the standard consistently, and where a medical issue surfaces, run the separate process described in our guide to the workplace accommodation process.

Second, protected activity. Heated disagreement about wages, staffing, or working conditions can be protected concerted activity under the National Labor Relations Act, and discipline that sweeps up an employee's complaint along with genuine misconduct draws scrutiny from the NLRB. Distinguish threatening behaviour from strongly expressed grievances, and document the former precisely.

Third, retaliation and discrimination. Employees who report threats, refuse genuinely unsafe work, or participate in an investigation have protections, some enforced by OSHA and some by the EEOC where the underlying conduct is harassment. Where violence overlaps with harassment based on a protected characteristic, both frameworks apply at once. The documentation and consistency principles are the same ones set out in our guides to performance documentation and retaliation exposure.

Quick answers

Is a written workplace violence plan legally required?

It depends entirely on where you operate and in what industry. A limited number of states require written plans, logs, and training, and several regulate health care settings specifically; most states have no such statute. Everywhere, the General Duty Clause obliges employers to address recognized hazards, and a written plan is the practical way to show that was done.

Can we fire someone for making a threat?

Generally yes, where the conduct violates a clear, consistently enforced policy and the facts are documented. Two cautions: confirm the conduct rather than relying on rumour, and check whether the exchange also involved protected complaints about working conditions. If a disability or medical condition is raised, evaluate conduct against the standard applied to everyone rather than substituting an assumption about dangerousness.

Does an incident have to be reported to OSHA?

Certain severe outcomes — a work-related fatality, and in-patient hospitalization, amputation, or loss of an eye — trigger reporting obligations within short deadlines, and violence-related injuries are not excluded. Other work-related injuries may be recordable on the injury and illness log. Check the current requirements and timeframes published by OSHA, and note that any state plan requirements apply in addition.

What if the threat comes from a customer or a stranger?

The duty does not depend on who the aggressor is. Third-party violence is the dominant risk category in retail, health care, transport, and service work, and the expected response is largely environmental — access control, staffing, cash handling procedures, visibility, alarms, and training on de-escalation and disengagement. Document the hazard assessment for each site and shift, because that is what establishes the measures were considered.

Should the plan be in the employee handbook?

A summary and the reporting route belong there, so employees know where to go. The operational detail — site assessments, security procedures, response protocols — usually sits in a separate document with controlled distribution. Keep the handbook version accurate against the operational plan, and re-acknowledge it when either changes.

Your next moves

Establish where you are covered: check every state where employees work for a workplace violence statute, a health-care-specific rule, or a state occupational safety plan, and check the current federal recordkeeping and reporting requirements at the Department of Labor. Then do a site-by-site hazard assessment, stand up a standing threat assessment team with a written charter, and make the reporting route unmissable. Train supervisors on one thing above all: report upward immediately and do not resolve threats privately. Review after every incident and at least annually, and record the changes you made — the record of what you did after learning of a hazard is what the analysis ultimately turns on. Related employer duties on policy, discipline, and accommodation sit together in the Workplace Rights & HR pathway.